Key Features of the Transaction Command
Which TWO of the following are true about the `transaction` command? (Choose 2)
Quick Answer
The answer is that the `maxpause` option defines the maximum allowed time gap between events in the same transaction. This is correct because the `transaction` command groups related events into a single search result based on time and field values, and `maxpause` sets the upper limit of idle time allowed between consecutive events before the transaction is considered complete. On the Splunk SPLK-1003 exam, this tests your understanding of how to control transaction boundaries, often appearing alongside the mandatory `by` clause—a common trap is forgetting that `by` is required to avoid grouping all events into one massive transaction. To remember, think of `maxpause` as a "silence timer": if the gap between events exceeds this pause, the transaction closes.
⚠ Common exam trap
A common misconception is that the `by` clause is mandatory for the `transaction` command. However, it is optional; omitting it groups all events into one transaction. Another misconception is that `startswith` operates on field values, when it operates on raw event text. Additionally, `transaction` outputs one event per transaction, not per input event.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It groups events that share common field values and occur within a specified time window.
The `transaction` command groups events that share common field values (specified by the `by` clause when used) and that occur within a specified time window, typically set by `maxspan` or using the default span. Option E is correct because the `maxpause` option defines the maximum allowed time gap between consecutive events in the same transaction; if the gap exceeds `maxpause`, a new transaction is started. Option C is incorrect because the `by` clause is not mandatory; without it, the command groups all events into a single transaction, which can be useful in certain scenarios. Options A and B are incorrect as originally stated.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Transactions can be started based on a specific field value using the `startswith` option.
Why it's wrong here
Incorrect. The `startswith` option matches on raw event text, not on a specific field value.
- ✗
It outputs one event per input event, adding duration and eventcount fields.
Why it's wrong here
Incorrect. The `transaction` command outputs one event per transaction, adding `duration` and `eventcount` fields, not one event per input event.
- ✗
The `by` clause is mandatory to define how to group events.
Why it's wrong here
Incorrect. The `by` clause is not mandatory; it defines how to group events, but if omitted, all events are grouped into a single transaction.
- ✓
It groups events that share common field values and occur within a specified time window.
Why this is correct
Correct as is.
- ✓
The `maxpause` option defines the maximum allowed time gap between events in the same transaction.
Why this is correct
Correct as is.
Go deeper
Related to this question
About these practice questions
One of 475 original SPLK-1002 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SPLK-1002
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO of the following statements about the 'transaction' command are true? (Choose two.)
medium- ✓ A.It can add a 'duration' field to the result events.
- B.It requires events to be sorted by _time in descending order.
- C.It can only be used with 'startswith' and 'endswith' options.
- D.It requires at least one field in the 'by' clause.
- ✓ E.It groups events that are logically related based on common field values and time proximity.
Why A: The 'transaction' command automatically adds a 'duration' field to the result events, which represents the time difference between the first and last event in the transaction. This is a built-in behavior of the command, not an optional setting.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.